PatchSiren

PatchSiren cyber security CVE debrief

CVE-2022-49034 Siemens CVE debrief

A Linux kernel vulnerability in the /proc/cpuinfo implementation that generates runtime warnings when specific debug configuration options are enabled. The issue occurs when CONFIG_CPUMASK_OFFSTACK and CONFIG_DEBUG_PER_CPU_MAPS are both selected, causing cpu_max_bits_warn() to trigger warnings during cpuinfo display operations. This represents a local availability impact with medium severity.

Vendor
Siemens
Product
RUGGEDCOM RST2428P (6GK6242-6PA00)
CVSS
MEDIUM 5.5
CISA KEV
Not listed in stored evidence
Original CVE published
2025-08-12
Original CVE updated
2026-02-25
Advisory published
2025-08-12
Advisory updated
2026-02-25

Who should care

Operators of Siemens industrial network infrastructure, OT security teams managing SCALANCE and RUGGEDCOM deployments, kernel maintainers for embedded industrial systems, and organizations with defense-in-depth ICS security requirements.

Technical summary

The vulnerability exists in the Linux kernel's /proc/cpuinfo implementation. When the kernel is compiled with both CONFIG_CPUMASK_OFFSTACK and CONFIG_DEBUG_PER_CPU_MAPS configuration options enabled, the cpu_max_bits_warn() function generates runtime warnings during cpuinfo display operations. This is classified as CWE-20 (Improper Input Validation). The CVSS 3.1 vector indicates local attack vector, low attack complexity, low privileges required, no user interaction, with high availability impact. The vulnerability affects Siemens industrial networking products including RUGGEDCOM RST2428P and SCALANCE switch families running vulnerable kernel configurations.

Defensive priority

medium

Recommended defensive actions

  • Review kernel configuration on affected Siemens devices to determine if CONFIG_CPUMASK_OFFSTACK and CONFIG_DEBUG_PER_CPU_MAPS are enabled
  • Apply vendor-provided updates: update RUGGEDCOM RST2428P and SCALANCE XCM-/XRM-/XCH-/XRH-300 family to V3.2 or later
  • For SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family, consult Siemens ProductCERT SSA-355557 for specific configuration guidance
  • Monitor system logs for cpu_max_bits_warn() runtime warnings as indicator of vulnerable configuration
  • Implement defense-in-depth strategies per CISA ICS recommended practices for industrial control systems
  • Restrict local access to affected devices to authorized personnel only
  • Validate kernel build configurations in device firmware prior to deployment

Evidence notes

CVE published 2025-08-12; modified 2026-02-25. CISA ICS advisory ICSA-25-226-07 published same date. Siemens ProductCERT SSA-355557 advisory referenced as authoritative source. Advisory revised multiple times through February 2026 to correct affected products and clarify configurations.

Official resources

public